847d120f4c75d910dd45e62586ffd0c9c5fd739b7887cf0b1e7f4efa10c6bb52

Analysis

max time kernel
117s
max time network
130s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25-08-2024 08:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c060df59d4da402547da7ec6c7c0b05d_JaffaCakes118.html
Size

17KB
MD5

c060df59d4da402547da7ec6c7c0b05d
SHA1

9219f1f5a282b3c548ca34e21f7d62baf27b11a2
SHA256

847d120f4c75d910dd45e62586ffd0c9c5fd739b7887cf0b1e7f4efa10c6bb52
SHA512

2f7fef2d33859982b1a07dbe6d7961c2fd93f27b30b914ec052ab184735553fbb1edcf3f73698579a338162b1ad86b030b4c883d8007c3d9cfbfcecf70055f93
SSDEEP

384:LcMu1qPBMKBM3BM0BMXBMGcBMTFHl8/yOJOThxpJOWn3tOytOwk6q:LC0PCKC3C0CXCzCFz7nE6q

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d040e645ccf6da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6FA0FDC1-62BF-11EF-888D-D67B43388B6B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c92000000000200000000001066000000010000200000009d0af98b64854716440f2e06385e57fde4c151e3865bb689de0fc77aedd51be4000000000e80000000020000200000005baa8af3c071845dd814372d9af0ea46e47e09e22278963648c42c416ecd376e90000000cae1bdb6d55500ec4933634ff697d8d3c84df4274e5324a8421fecc34ab5186e364ce061e925f04410dfe5af48ab189bc3babbfcb961f62db1082626c117db08964d8e9f4e8c57a9a3779953591c42436b71853178178d013a0dce609d282a35feaec45ed7a06fffa6a6d79d5db7965f50b231f23d3a2580ce6b334b52742f2a4e65b71e9828af5c3947bd57fd2fdc6440000000925619e9e293310d8f9567085fbdb4e87b6f37db8d18e4b4ece097933570425e8ff58217c55c3588e66f4da79f00843fb3a9cebae15dec967ce4ef92d2986520	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430737850"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c92000000000200000000001066000000010000200000009188503498d11767bc5a1e89149573bb7f640ad961dd506d2eb9c7fd2886d3ee000000000e8000000002000020000000d75b7e278e58d0eaf17fae7f6f08b1b753915e94bb141826d7fd8f743c12d41a20000000448e119c1a6b92b9b01fa75b60c4bd173c05db509850388c4a31d01c00402e2b40000000b38422413b68365ca5719062819b43fb741f47cc70cabe2919b25285a8f3739a85286cfcf5ace08f6ebdf67a75a3e2e7899929afc9f20356ba0185f3c34ce590	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2508	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2508	iexplore.exe
2508	iexplore.exe
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2304	2508	iexplore.exe	31
PID 2508 wrote to memory of 2304	2508	iexplore.exe	31
PID 2508 wrote to memory of 2304	2508	iexplore.exe	31
PID 2508 wrote to memory of 2304	2508	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c060df59d4da402547da7ec6c7c0b05d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2508 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8748ac3197e58e0477dfc619dc9af5b1

SHA1
fbd5ac8c276581af2906650ca8a976175ac26ae5

SHA256
15bfc4635eee2b0997d841b2d74af2ddb352bef631bb4afce9708dfb08c7f50f

SHA512
c0729551499c9a490d021732ec4601fa21c655e788c90372910dd8991c8256310a10e8ef9e9009c6136e432373357ed980dd76955e3e30a3f1a11cc49ea66664

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d175410ca75899ac4dabbbb706f70cb

SHA1
2438e2687c95f7ea91ba58b2f9781ab77169a4cc

SHA256
0bcb70efa2ac0cd9d5c16b72fa7ffdef4ec2b43b92c93e705959d3a74c938715

SHA512
df1596e479a9a5491ee28a3d0b081c9879e15aeff148ab9ff14c8803716eca62999cc62a6055d0bdec930b7e463a286b8bbfdac943aefa3c3a72b6d3dfaa2690

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
babe5470479ee28bbe3ff151cdb60eec

SHA1
833bff7f68e8de4ec7ec6ff9fb644bbd9444e0ec

SHA256
9d4bef4d06e2d07a99953cc367e307062b0767f6f466cb0662abbeed4094fb8b

SHA512
a3c639ab82f274bfb0a5875c2f226e203215fb199d2f35f722faa9967bd734008326bb5d4d16f5de79288b78d045b67c9bccc41c71cebb73544eaa935b6c8f89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a529a7f58790e254e09e81d8f831ebe

SHA1
557b60f706da469b1a6113840ad710d602fa72f6

SHA256
821022d8e476e7e24d35cd20cfaed1e0b47ca17267ad649852db235111275cb9

SHA512
28eded602481c3213695c282b79ffbe95dc52f68b235eabfb20e10c43cc6c3b778c0f1742401e8a59661e880d459fb8bfe8716c19539f8ad88ce49865369894f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcd13f3919fa1e56b2126e4e8093fe01

SHA1
184180951a6cc8e1830446664c2e3fb80e3c529b

SHA256
515960e00bed8a5ba8fe624f6c84954d2ee4351e3835eb806f5023391081c875

SHA512
f2ba7d6e031602dd43115e4a09303f03552ff4546be891947f09c16e4499a243867c1aa41ff59323de819e6d4d0940a779775d5c358d5d2907777d0e6a7a1248

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59b1d6207a6824ef8bbfaa743a51ef27

SHA1
bdcb7b4879833884014bfb44518cdc61a19ff7e6

SHA256
60ded054b7ae88181bdc4fdd5bacc9384d9a19c6f1a22c3bf62b7c4052650171

SHA512
759ea70e7a24010d7f2a8e167e77edcb7233e04c49e758788fe2803c31507ff2dbb1d1ee12625e2cabc1749e33db95fb1fcbe223195e63f75026ab2d138b46bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a2b3b89313e93d078d88edc00faa487

SHA1
4ba474e52ade5035a68a370e5d185109e9697ad6

SHA256
483873119e05b23f630551036b9cd44cd5de7915e9003a8ebe6c663bf82d3a95

SHA512
840baf0cd246187ccbe7d5d14b97e53279d850d9259aba9dde2ebebe4e162ce6169e3ff7b0cdc9bb9bfbdb470789480bfe6bae82bdf0257d9f7edf656cae51a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ce8a31d589cd7e610aa3989578ef8b1

SHA1
531e8d11e2b98ff29c04cc6f80f5ca748cdf4d9c

SHA256
6a1210ffc1ca179d8f87cf0e63c506cf6a363f12904c353ed4d89bc08e9a358e

SHA512
e5cd048e082ff1ddfc86018f1561297d56a8b97d8275e465e03a57d288dd72eb9fecdd78d28c70b6ae9f9e4da011dac250f49da3625edc6168d448e82e295fbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
891ddea0667a586c363e367aa4566ad7

SHA1
cbc61dc3ee80eac774a443d5b4321296b923c32e

SHA256
fcf7489d5de972e287653d126ac7cbecbe977108430dc5ab11501b8bf4041674

SHA512
2c9ab737084aca56f503a3a3d6a80b56060c8ca1be2b77f5db570b4512563c37f593ec8ec41c0645d7b9f945df5bd2b8c2063f4a337a348fd68ce25e08cb2ec2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f872cf0b4361ea065d264c6de410b04a

SHA1
01f48a532b228a98c7816745e62ff456757800cd

SHA256
490fd54075f2ab1a891d42fd0d4b235d10a7607dc09389e9a2a002b69d4afb73

SHA512
e5508d795ed89d169e25fa95adfcfef6518ec016e657149b08aa883d467fc4e5a5626d09baa840d50bfd24ae6f1a264fc0a8571ca9f6707ea52f990340e7010d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbd85c05f6c33b0b077006ef26b4cbaa

SHA1
49e955874274f3bffd11ee6ef9fe79b0e7f26afc

SHA256
b4647c90f3269c3e8bf90edd65fc2e6babc218fcca0b075ab21c7984d17bcd61

SHA512
e9920a0162d7e89170303a01a228388183a3d50150301afa3221371dc6fd247f72474f4be32bb3ab050e3e0f079c0399b43823462fe95342a321c426345d169d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5194f779ea5d65270e3ca659dde547fd

SHA1
58b3e75bba3aa56802c58eba35f242e89f7a5e37

SHA256
38d82a202174c5833af45b7fb2448125b63dd2ba066b0667f597c670330be0a8

SHA512
415d49b720fc67eb16a2c44bea880b080d999013e621dec87c0585a62611c99a680600e07f8b2e9ba4e083534e5b30b1a2c2cc2c6d1b25cef8f9708451e0eb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab17A7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1857.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit